If EntryNodes and ExcludeNodes overlap, obey ExcludeNodes.

src/or/circuitbuild.c

@@ -2938,6 +2938,7 @@ warn_if_last_router_excluded(origin_circuit_t *circ, const extend_info_t *exit)
            description,exit->nickname,
            rs==options->ExcludeNodes?"":" or ExcludeExitNodes",
            (int)purpose);
+    /* XXX022-1090 "using anyway" is freaking people out -RD */
     circuit_log_path(LOG_WARN, domain, circ);
   }
 
@@ -3979,7 +3980,8 @@ entry_guards_prepend_from_config(or_options_t *options)
    *  Perhaps we should do this calculation once whenever the list of routers
    *  changes or the entrynodes setting changes.
    */
-  routerset_get_all_routers(entry_routers, options->EntryNodes, 0);
+  routerset_get_all_routers(entry_routers, options->EntryNodes,
+                            options->ExcludeNodes, 0);
   SMARTLIST_FOREACH(entry_routers, routerinfo_t *, ri,
                     smartlist_add(entry_fps,ri->cache_info.identity_digest));
   SMARTLIST_FOREACH(entry_guards, entry_guard_t *, e, {
@@ -4155,7 +4157,7 @@ choose_random_entry(cpath_build_state_t *state)
       goto retry;
     }
     if (!r && entry_list_is_constrained(options) && consider_exit_family) {
-      /* still no? if we're using bridges or have strictentrynodes
+      /* still no? if we're using bridges or have StrictNodes
        * set, and our chosen exit is in the same family as all our
        * bridges/entry guards, then be flexible about families. */
       consider_exit_family = 0;

src/or/config.c

@@ -1412,7 +1412,8 @@ options_act(or_options_t *old_options)
   /* Check if we need to parse and add the EntryNodes config option. */
   if (options->EntryNodes &&
       (!old_options ||
-      (!routerset_equal(old_options->EntryNodes,options->EntryNodes))))
+       !routerset_equal(old_options->EntryNodes,options->EntryNodes) ||
+       !routerset_equal(old_options->ExcludeNodes,options->ExcludeNodes)))
     entry_nodes_should_be_added();
 
   /* Since our options changed, we might need to regenerate and upload our

src/or/or.h

@@ -2387,7 +2387,7 @@ typedef struct {
                                  * ORs not to consider as exits. */
 
   /** Union of ExcludeNodes and ExcludeExitNodes */
-  struct routerset_t *_ExcludeExitNodesUnion;
+  routerset_t *_ExcludeExitNodesUnion;
 
   int DisableAllSwap; /**< Boolean: Attempt to call mlockall() on our
                        * process for all current and future memory. */
@@ -3487,7 +3487,7 @@ typedef struct trusted_dir_server_t {
 
 #define ROUTER_MAX_DECLARED_BANDWIDTH INT32_MAX
 
-/* Flags for pick_directory_server and pick_trusteddirserver. */
+/* Flags for pick_directory_server() and pick_trusteddirserver(). */
 /** Flag to indicate that we should not automatically be willing to use
  * ourself to answer a directory request.
  * Passed to router_pick_directory_server (et al).*/

src/or/routerlist.c

@@ -5516,10 +5516,11 @@ routerset_contains_routerstatus(const routerset_t *set, routerstatus_t *rs)
 }
 
 /** Add every known routerinfo_t that is a member of <b>routerset</b> to
- * <b>out</b>.  If <b>running_only</b>, only add the running ones. */
+ * <b>out</b>, but never add any that are part of <b>excludeset</b>.
+ * If <b>running_only</b>, only add the running ones. */
 void
 routerset_get_all_routers(smartlist_t *out, const routerset_t *routerset,
-                          int running_only)
+                          const routerset_t *excludeset, int running_only)
 {
   tor_assert(out);
   if (!routerset || !routerset->list)
@@ -5529,12 +5530,13 @@ routerset_get_all_routers(smartlist_t *out, const routerset_t *routerset,
   if (routerset_is_list(routerset)) {
 
     /* No routers are specified by type; all are given by name or digest.
-     * we can do a lookup in O(len(list)). */
+     * we can do a lookup in O(len(routerset)). */
     SMARTLIST_FOREACH(routerset->list, const char *, name, {
         routerinfo_t *router = router_get_by_nickname(name, 1);
         if (router) {
           if (!running_only || router->is_running)
-            smartlist_add(out, router);
+            if (!routerset_contains_router(excludeset, router))
+              smartlist_add(out, router);
         }
     });
   } else {
@@ -5544,7 +5546,8 @@ routerset_get_all_routers(smartlist_t *out, const routerset_t *routerset,
     SMARTLIST_FOREACH(rl->routers, routerinfo_t *, router, {
         if (running_only && !router->is_running)
           continue;
-        if (routerset_contains_router(routerset, router))
+        if (routerset_contains_router(routerset, router) &&
+            !routerset_contains_router(excludeset, router))
           smartlist_add(out, router);
     });
   }

src/or/routerlist.h

@@ -173,6 +173,7 @@ int routerset_contains_routerstatus(const routerset_t *set,
 int routerset_contains_extendinfo(const routerset_t *set,
                                   const extend_info_t *ei);
 void routerset_get_all_routers(smartlist_t *out, const routerset_t *routerset,
+                               const routerset_t *excludeset,
                                int running_only);
 void routersets_get_disjunction(smartlist_t *target, const smartlist_t *source,
                                 const routerset_t *include,